ScreenConnect campaign turns MSP support sessions into a customer…New N-central exploit claim shifts HF2 closure to Legacy API isolationBarracuda root chain requires compromise review, not patch-only closureRailway report turns AI keys into a financial and machine-identity risk

Security.io Daily Intelligence · Executive decision brief

ScreenConnect campaign turns MSP support sessions into a customer propagation path

A live campaign is using compromised ScreenConnect environments to install rogue remote-access clients and may turn technician sessions into a route for further downstream propagation.

Security.io Intelligence Desk · Thursday, 12 November 2026

Executive consequence

ConnectWise and Huntress disclosed an active campaign affecting ScreenConnect partner environments and downstream customer devices.

Decision today

Disable the five listed third-party extensions and prevent reinstall.

Read the full decision briefPrimary reporting: ConnectWise Trust Center · Huntress Support · BleepingComputer

Decision intelligence, not a headline feed.Every edition ranks what security leaders should read first, assign today and monitor next.

Daily executive briefing

Security.io Daily Headlines

Five equally weighted stories: what happened and the leadership decision each creates.

Read this edition’s headlines

Today’s decision ledger

What changed · Why it matters · What to do

Vulnerability Management

New N-central exploit claim shifts HF2 closure to Legacy API isolation

Why it matters

N-able’s HF2 hotfix remains required, but a new public exploit chain called 4EverAble2Shell is reported to work against build 2026.4.1.26 when the non-default Legacy API is enabled and internet-exposed.

Do today

Keep on-premises N-central inaccessible from the internet.

Read the briefing →

Vulnerability Management

Barracuda root chain requires compromise review, not patch-only closure

Why it matters

CVE-2026-116606 can bypass authentication on Barracuda Email Security Gateway, while CVE-2026-111560 can execute commands as root across several Barracuda appliances.

Do today

Identify every Barracuda appliance and administrative-interface exposure.

Read the briefing →

AI Security

Railway report turns AI keys into a financial and machine-identity risk

Why it matters

Railway’s detailed report materially expanded the known scope of its October intrusion. The company said an attacker exploited its build infrastructure, moved through internal systems and decrypted variables for an upper bound of about 100,000 workspaces.

Do today

Review AI-provider usage and billing for unauthorised consumption.

Read the briefing →

Enterprise Risk

Maersk confirmation exposes the governance gap around acquired legacy systems

Why it matters

Maersk confirmed that an unauthorised party accessed and extracted data from a local legacy system inherited through a previous acquisition.

Do today

Inventory acquired logistics systems that remain outside standard controls.

Read the briefing →

Signal desk

Evidence that changes prioritisation

Lead story exposure snapshot

ScreenConnect campaign scope at publication cutoff

The first three values are Huntress counts reported during the initial campaign response. The 400 value is ConnectWise’s count of partner environments with listed extensions installed, not confirmed compromises; snapshot cut off at 06:00 America/New_York on 12 November 2026. Source: BleepingComputer reporting citing Huntress and ConnectWise.

Back page

Daily comic · Circuit Chuckles

A brief pause after the intelligence

Session Recording

Rusty uses a cassette recorder for privileged session recording and treats the tape as an analog audit trail.

Thursday, 12 November 2026Open comic page →